【Rails】Policyオブジェクト入門｜認可ロジックを整理する

# Minimal authorization through OO design and pure Ruby classes [https://github.com/varvet/pundit]
gem 'pundit'

$ bundle install
$ rails g pundit:install
      create  app/policies/application_policy.rb

$ rails g pundit:policy Post
      create  app/policies/post_policy.rb

# app/policies/post_policy.rb
class PostPolicy < ApplicationPolicy
  # ポリシーメソッドは user と record を引数に取る

  # 公開記事は誰でも、下書きは作成者か管理者のみ閲覧可
  def show?
    record.published? || (user && (record.user == user || user.admin?))
  end

  # ログインユーザーなら作成可
  def create?
    user.present?
  end

  # 管理者か作成者なら更新可
  def update?
    user && (user.admin? || record.user == user)
  end

  # 管理者のみ削除可
  def destroy?
    user && user.admin?
  end

  # --- 一覧取得時の絞り込み用 (後述) ---
  class Scope < Scope
    def resolve
      if user&.admin?
        scope.all
      elsif user
        scope.where(published: true).or(scope.where(user: user, published: false))
      else
        scope.where(published: true)
      end
    end
  end
end

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  include Pundit::Authorization

  # 認可失敗時 (Pundit::NotAuthorizedError) の共通処理
  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized

  private

  # Punditはデフォルトで `current_user` を使う。違う場合は `pundit_user` を定義。
  # def pundit_user
  #   current_admin
  # end

  def user_not_authorized(exception)
    # エラー内容をログに出力しても良い
    flash[:alert] = "この操作を実行する権限がありません。"
    redirect_back(fallback_location: root_path)
  end
end

# app/controllers/posts_controller.rb
class PostsController < ApplicationController
  before_action :set_post, only: [:show, :edit, :update, :destroy]

  def show
    authorize @post # PostPolicy#show? が呼ばれる
  end

  def edit
    authorize @post # PostPolicy#update? (または edit?) が呼ばれる
  end

  def update
    authorize @post # PostPolicy#update? が呼ばれる
    if @post.update(post_params)
      # ... redirect ...
    else
      # ... render ...
    end
  end

  def destroy
    authorize @post # PostPolicy#destroy? が呼ばれる
    @post.destroy
    # ... redirect ...
  end

  def new
    @post = Post.new
    authorize @post # PostPolicy#create? (または new?) が呼ばれる
  end

  def create
    @post = Post.new(post_params)
    authorize @post # PostPolicy#create? が呼ばれる
    if @post.save
      # ... redirect ...
    else
      # ... render ...
    end
  end

  private

  def set_post
    @post = Post.find(params[:id])
  end

  def post_params
    params.require(:post).permit(:title, :content, :published)
  end
end

<%# app/views/posts/show.html.erb %>
<% if policy(@post).edit? %>
  <%= link_to '編集', edit_post_path(@post) %>
<% end %>

<% if policy(@post).destroy? %>
  <%= button_to '削除', @post, method: :delete, data: { turbo_confirm: '削除しますか?' } %>
<% end %>

<%# 新規作成リンク (クラスを渡す) %>
<%# if policy(Post).new? %>
<%#   <%= link_to '新規投稿', new_post_path %>
<%# end %>

# app/policies/post_policy.rb
# (前述の Policy::Scope#resolve の実装を参照)

# app/controllers/posts_controller.rb
class PostsController < ApplicationController
  def index
    # PostPolicy::Scope#resolve が呼ばれ、絞り込まれたスコープが返る
    @posts = policy_scope(Post.includes(:user).order(created_at: :desc))
    # ビューでは @posts をそのまま使う
  end
  # ...
end

# Gemfile
group :test do
  # A set of RSpec matchers for testing Pundit authorisation policies.[https://github.com/pundit-community/pundit-matchers]
  gem 'pundit-matchers'
end

# spec/policies/post_policy_spec.rb
require 'rails_helper'

RSpec.describe PostPolicy, type: :policy do
  subject { described_class }

  let(:author) { create(:user) }
  let(:admin) { create(:user, :admin) }
  let(:other_user) { create(:user) }
  let(:guest) { nil }
  let(:post) { create(:post, user: author) }

  # 例: update? アクションのテスト
  permissions :update?, :edit? do
    context 'when user is admin' do
      it { is_expected.to permit(admin, post) } # is_expected は expect(subject) と同じ
    end

    context 'when user is author' do
      it { is_expected.to permit(author, post) }
    end

    context 'when user is other user' do
      it { is_expected.to forbid(other_user, post) }
    end

    context 'when user is guest' do
      it { is_expected.to forbid(guest, post) }
    end
  end

  # 例: create? アクションのテスト
  permissions :create?, :new? do
    let(:new_post) { Post.new } # クラスのインスタンスでテスト

    it 'grants access if user is logged in' do
      expect(subject).to permit(admin, new_post)
      expect(subject).to permit(author, new_post)
      expect(subject).to permit(other_user, new_post)
    end

    it 'denies access if user is guest' do
      expect(subject).to forbid(guest, new_post)
    end
  end
  # 他のアクション (show?, destroy?) も同様にテストする
end

# spec/policies/post_policy_scope_spec.rb
require 'rails_helper'

RSpec.describe PostPolicy::Scope, type: :policy do
  let(:admin) { create(:user, :admin) }
  let(:user1) { create(:user) }
  let(:guest) { nil }

  let!(:admin_post) { create(:post, user: admin, published: true) }
  let!(:user1_published) { create(:post, user: user1, published: true) }
  let!(:user1_draft) { create(:post, user: user1, published: false) }

  let(:scope) { Post.all }

  context 'for admin user' do
    it 'returns all posts' do
      resolved_scope = described_class.new(admin, scope).resolve
      expect(resolved_scope).to contain_exactly(admin_post, user1_published, user1_draft)
    end
  end

  context 'for user1' do
    it 'returns published posts and own draft posts' do
      resolved_scope = described_class.new(user1, scope).resolve
      expect(resolved_scope).to contain_exactly(admin_post, user1_published, user1_draft)
    end
  end

   context 'for guest user' do
     it 'returns only published posts' do
       resolved_scope = described_class.new(guest, scope).resolve
       expect(resolved_scope).to contain_exactly(admin_post, user1_published)
     end
   end
end